cyber · In Force

CERT-In Directions 2022

6-hour incident reporting mandatory. 180-day log retention. VPN providers retain user data 5 years. Crypto exchanges covered. NTP clock synchronisation mandatory.

Enforced

28 April 2022

Ministry

Ministry of Electronics & IT

Key provisions and changes

• 6-hour incident reporting
• 180-day log retention
• VPN user data 5 years
• Crypto exchanges covered
• NTP synchronisation mandatory